From: Herbert Xu <herbert@gondor.hengli.com.au>
To: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
linux-security-module@vger.kernel.org,
Dmitry Kasatkin <d.kasatkin@samsung.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
James Morris <jmorris@namei.org>,
David Howells <dhowells@redhat.com>
Subject: Re: [PATCH v2 01/23] crypto: provide single place for hash algo information
Date: Tue, 22 Oct 2013 20:07:04 +0800 [thread overview]
Message-ID: <20131022120704.GA9375@gondor.apana.org.au> (raw)
In-Reply-To: <CACE9dm-m4f7LYuTADmn_upUEoMjDUKMTBXdnKT=9j+RiqWSp4Q@mail.gmail.com>
On Tue, Oct 22, 2013 at 12:57:02PM +0100, Dmitry Kasatkin wrote:
> On Tue, Oct 22, 2013 at 12:32 PM, Herbert Xu
> <herbert@gondor.apana.org.au> wrote:
> > On Tue, Oct 22, 2013 at 12:29:56PM +0100, Dmitry Kasatkin wrote:
> >>
> >> We are not adding user-space interface.
> >> We just need to algo definitions which are in sync between user space,
> >> IMA/EVM and kernel module signing.
> >> Module signing perl script uses hard coded values. We want to improve
> >> it export them to user space.
> >>
> >> But please give us a hint, what crypto user-space API helps for us?
> >
> > OK, if you're not exporting the kernel asymmetric key code then
> > that's fine.
>
> Can we take this to mean acked-by you?
FWIW I'm against introducing new interfaces using integer IDs
for crypto algorithms. Especially if such an interface is exposed
to user-space.
You said that you're not currently using this as a kernel/user-space
interface, which I can live with grudgingly.
However, the fact that you've placed this file in uapi leads me to
believe that at some future point in time there will be some sort
of kernel/user-space interface using this. Why else would they need
to be in sync?
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
next prev parent reply other threads:[~2013-10-22 12:07 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-21 22:42 [PATCH v2 00/23] ima: larger digests and extensible template support Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 01/23] crypto: provide single place for hash algo information Mimi Zohar
2013-10-22 5:24 ` Herbert Xu
2013-10-22 11:29 ` Dmitry Kasatkin
2013-10-22 11:32 ` Herbert Xu
2013-10-22 11:57 ` Dmitry Kasatkin
2013-10-22 12:07 ` Herbert Xu [this message]
2013-10-22 12:50 ` Mimi Zohar
2013-10-22 12:53 ` Herbert Xu
2013-10-21 22:42 ` [PATCH v2 02/23] keys: change asymmetric keys to use common hash definitions Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 03/23] ima: provide support for arbitrary hash algorithms Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 04/23] ima: read and use signature hash algorithm Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 05/23] ima: pass full xattr with the signature Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 06/23] ima: use dynamically allocated hash storage Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 07/23] ima: differentiate between template hash and file data hash sizes Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 08/23] ima: provide dedicated hash algo allocation function Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 09/23] ima: support arbitrary hash algorithms in ima_calc_buffer_hash Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 10/23] ima: ima_calc_boot_agregate must use SHA1 Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 11/23] ima: pass the file descriptor to ima_add_violation() Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 12/23] ima: pass the filename argument up to ima_add_template_entry() Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 13/23] ima: define new function ima_alloc_init_template() to API Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 14/23] ima: new templates management mechanism Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 15/23] ima: define template fields library and new helpers Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 16/23] ima: define new template ima-ng and template fields d-ng and n-ng Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 17/23] ima: switch to new template management mechanism Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 18/23] ima: add audit log support for larger hashes Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 19/23] ima: defer determining the appraisal hash algorithm for 'ima' template Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 20/23] ima: add Kconfig default measurement list template Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 21/23] ima: define kernel parameter 'ima_template=' to change configured default Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 22/23] ima: enable support for larger default filedata hash algorithms Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 23/23] ima: provide hash algo info in the xattr Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131022120704.GA9375@gondor.apana.org.au \
--to=herbert@gondor.hengli.com.au \
--cc=d.kasatkin@samsung.com \
--cc=dhowells@redhat.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®